CVE-2025-3240 is a high severity SQL injection flaw (CVSS 7.3) in PHPGurukul Online Fire Reporting System 1.2. It affects /admin/search.php, where the searchdata argument reaches a database query unsafely. The record lists no fixed version, so check with the vendor, limit exposure, and rewrite the query with prepared statements.
What's affected
The NVD record names PHPGurukul Online Fire Reporting System version 1.2. The weak spot is the file /admin/search.php, and the argument the record points to is searchdata. The two weakness classes are CWE-74 (improper neutralization of special elements in output used by a downstream component) and CWE-89 (SQL injection).
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain terms, the flaw can be reached over the network, needs little skill to attempt, and the vector shows that no login is required. Each of confidentiality, integrity and availability is rated low, which is why the score is 7.3 and not higher.
The record does not list a fixed version, and it says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Treat any copy of this software that is reachable from the internet as the priority.
How to check if you're exposed
This is a PHP style web application distributed as source code, so there is usually no package manager entry to query. Check your own deployment instead.
- Find out whether you run it. Search your web roots for the vulnerable file name:
find /var/www -type f -name 'search.php' 2>/dev/null
- Confirm the version from the project's own files, install notes or the page footer, and compare it with version 1.2 from the record.
- Look at how the searchdata value is used. A query built by joining strings with request input is the pattern the advisory describes:
grep -n 'mysqli_query\|->query(' admin/search.php 2>/dev/null
- Review web server access logs for requests to that file with unusual characters in the parameter, and for database errors around the same times.
If you manage many repositories, the free in-browser dependency scan covers the libraries your projects pull in, and the Gold directory lets you look up other CVEs by product. Neither replaces reading the code of a hand-deployed PHP application.
What to do now
- Restrict who can reach the application. Network controls are the fastest change you can make today.
- Contact the vendor or check its site for a release note. The record gives no fixed version, so the advisory should be checked before you plan an upgrade.
- Replace string built SQL in
/admin/search.phpwith prepared statements, and cast numeric inputs such as searchdata to the expected type before use. - Limit database permissions and separate read and write accounts where you can.
- Add monitoring for repeated errors from the affected page.
- Scan the codebase for the same pattern in sibling files, because the same author often repeats a coding habit.
Why it matters
Injection flaws stay common because the vulnerable code looks harmless. A search box, a profile field or an ID in a link can each end up inside a query. The record ties this one to searchdata in /admin/search.php, and says a public write up of the problem exists.
Public disclosure shortens the time between a bug being known and it being tried against exposed systems. That is not the same as confirmed exploitation, and no source reviewed says it is happening here. It is a reason to act early on anything internet facing.
Quick check
Is there a fixed version of Online Fire Reporting System?
The NVD record does not list one. Check the vendor site and the record's references before you assume a patch exists, and apply the mitigations above in the meantime.
Is this exploited in the wild?
The record says the exploit was disclosed publicly. It is not on the CISA Known Exploited Vulnerabilities list, and nothing reviewed confirms active attacks.
Sources
- Gold entry for CVE-2025-3240
- NVD record for CVE-2025-3240, published 2025-04-04, as summarised above
- Reference listed in the record
- Reference listed in the record
- Reference listed in the record
- Reference listed in the record
Last reviewed: 19 October 2026.
